CVE-2023-6066

Name of the Vulnerable Software and Affected Versions WP Custom Widget area WordPress plugin versions 1.2.5 and earlier

Description The issue arises from the plugin not properly applying capability and nonce checks on its AJAX action callback functions. This could allow attackers with subscriber+ privilege to create, delete, or modify menus on the site.

Recommendations For versions 1.2.5 and earlier, update to a version that properly applies capability and nonce checks on AJAX action callback functions. As a temporary workaround, consider restricting access to the AJAX action callback functions until a patch is available.